Cloudflare Access passkeys: setup, enrollment and policy checks

Passkeys authenticate users; policies still decide application access

On November 6, 2026, Cloudflare announced passkey support for protected Access applications and the App Launcher. Passkeys use WebAuthn to authenticate through a device, security key or password manager. The authenticator must support discoverable credentials and user verification, such as a fingerprint, face scan or PIN. An arbitrary hardware key does not necessarily meet those requirements.

Access still evaluates application policies after authentication. Passkey authentication does not retrieve group memberships or custom attributes from another identity provider. Adding it to the login options therefore does not establish that existing rules depending on those attributes will admit users in the same way.

Add the provider, then check each application

Administrators can open Zero Trust > Integrations > Identity providers. If Passkeys is already listed, review its settings. Otherwise, select Add an identity provider > Passkeys, optionally enable Automatically prompt on the login page, and save. Automatic prompting opens the browser’s passkey prompt for returning users; the value in the documentation’s API example does not establish every account’s default.

Next, open Access controls > Applications, edit the application and select Login methods. If Accept all available identity providers is off, add Passkeys to the providers allowed for that application. Keep other login methods users still need and save. The App Launcher has a separate Authentication tab where Passkeys must be allowed.

Before offering passkeys as an alternative, review application policies that rely on an external identity provider’s groups or custom attributes. The announcement and setup documentation reviewed here do not list universal plan eligibility, prices, countries or account-by-account rollout times. Check the organization’s actual settings and applicable terms; the announcement does not establish free or unconditional worldwide access.

Verify identity before enrolling the first passkey

Use a compatible browser and passkey authenticator, then open an application that allows passkeys. On the Access login page, select Sign in with a passkey and then Don’t have a passkey? Set one up. Verify identity using an available login method. If passkeys are the application’s only login method, Access sends an email verification code during enrollment.

Enter a recognizable name, select Add passkey and follow the browser or operating system prompts to save it. Select Back to sign in when finished. Saving a credential and satisfying application policies are separate steps; an enrolled passkey does not automatically grant access to every protected application.

Sign in without an email address, or cancel an automatic prompt

Open an application that allows passkeys, select Sign in with a passkey, choose a saved credential and complete the authenticator’s verification prompt. This sign-in flow does not require an email address. Access then evaluates application policies.

If an administrator enables automatic prompts, returning users may see the browser prompt immediately. They can cancel it and choose another allowed login method. Supported browsers may also offer saved passkeys in the email field; the behavior depends on browser support.

Separate credential removal from ending active sessions

Users can select Manage passkeys on the Access login page, authenticate using an available method, then add, rename or delete their own passkeys and confirm the change. Names can help identify devices or purposes, but do not change application authorization.

The documented administrator path is Zero Trust > Team & Resources > Users. Select the user, open User identity, then delete the relevant entry under Passkeys and confirm. Access will stop accepting that credential for future sign-ins.

Deleting the credential does not automatically end the user’s existing Access sessions. Revoke sessions separately when active sessions need to end. Do not treat credential deletion as an immediate sign-out on every device.

Check the device and allowed recovery methods when a credential is missing

If a saved passkey does not appear, first check whether it is available on the current device or in the password manager being used. Where supported, follow the browser’s prompts to use a passkey from another device. This is not a universal capability across all browsers and authenticators.

If a registered credential cannot be used, choose another allowed login method or contact the administrator, then follow enrollment to create a replacement. This article is based on public announcements and documentation. No organization dashboard was accessed, passkey enrolled or policy changed.